As AI transforms diagnostics and clinical decision-making, the frameworks governing its use are evolving fast. Here is what every medtech and digital health professional needs to understand right now.
We have all seen the headlines: AI algorithms detecting cancer earlier than radiologists, identifying stroke patterns in seconds, flagging urgent cases before a clinician even opens the file. The potential is extraordinary and well documented.
But here is the reality behind the headlines: none of that potential reaches a patient without navigating one of the most complex and rapidly evolving global and regional regulatory landscapes in the history of medical technology.
In the last year, the regulatory environment for AI-enabled medical devices – particularly Software as a Medical Device (SaMD) – has reached a genuine inflection point. While standards and requirements are developing alongside the fast-evolving technology, one thing is clear: those that don’t prioritise regulatory alignment as much as integrating the technology itself may face serious delays, rework, and compliance risk.
The regulatory landscape
For medtech and digital health teams, the global regulatory picture is now genuinely multi-layered. The major frameworks across regional governments are moving in the same direction, but at different speeds and with different requirements. Here is an overview of the direction currently provided through the US Food and Drug Administration (FDA), EU Medical Device Regulation (EU MDR), International Medical Device Regulators Forum (IMDRF), and UK Medicines and Healthcare products Regulatory Agency (MHRA):
FDA/United States – ‘Total Product Lifecycle (TPLC)’
January 2025 draft guidance mandates documentation across model design, data lineage, bias analysis, and post-market monitoring, plus a Predetermined Change Control Plan (PCCP) for adaptive AI.
EU MDR + AI Act/European Union – ‘High-risk AI, double compliance’
AI-based SaMD is classified as high risk under the EU AI Act, triggering requirements on top of existing MDR obligations that include QMS, technical documentation, transparency, and human oversight.
IMDRF/Global – ‘Harmonisation in progress’
The IMDRF is developing SaMD and PCCP guidance to align frameworks globally, though jurisdictional variation remains in review timelines and classification.
UK MHRA/United Kingdom – ‘Principles based, innovation first’
The UK’s post-Brexit approach applies existing MHRA medical device guidance to AI, with a stated priority of avoiding barriers to innovation.
Core compliance challenges
These regulatory examples are not theoretical problems. They are the friction points that design engineers face on real projects – and where compliance-related gaps most commonly emerge in product development.
Adaptive algorithms don’t fit static regulatory frameworks. Traditional regulation assumes a fixed device. AI models that continue learning after entering the marketplace challenge many assumptions in IEC 62304, FDA 510(k), and MDR conformity assessments alike.
Traceability also breaks under a state of constant change. Maintaining end-to-end traceability from requirements through design, code, and verification – and keeping it current as the model evolves – remains one of the most common audit findings on SaMD projects.
Dual EU compliance adds significant overhead. Products subject to both EU MDR and the AI Act must simultaneously satisfy overlapping but distinct requirements around risk management, QMS, and technical documentation as guidance on harmonisation is still under development.
Explainability is not optional. Regulators including the FDA, EU MDR, and MHRA are actively investigating Explainable AI (XAI) requirements. Deep learning models that cannot surface their decision logic will face increasing scrutiny.
Data governance is a compliance issue, not just an ethics one. The intersection of cross-border data use, training data bias, and GDPR/HIPAA creates compliance exposure that now must be addressed in technical documentation as much as in privacy policies.
AI should be viewed as a tool to assist, rather than replace, healthcare professionals – and regulators are now codifying exactly that principle into law through mandatory human oversight requirements.
What this means for medtech teams
Compliance as a competitive advantage. Yet on the AI landscape, it’s hard to say when the regulatory picture will fully ‘settle’ – that is the nature of a dynamic technology. Successful leaders would be wise to build their compliance infrastructures to move with this dynamic development processes, not behind it.
Concretely, to offer a few examples, that means treating IEC 62304 traceability as a continuous, automated process rather than a documentation exercise only reserved for point of submission, embedding risk management per ISO 14971 into development workflows rather than retrofitting it, and developing a PCCP from day one for any model likely to learn or adapt after market introduction.
AI-powered compliance tooling is now mature enough to support this. Platforms purpose-built for SaMD workflows can automate RTM generation, enforce QMS procedures within developer tools, and gate releases against unresolved risk control evidence. The question is no longer whether such tools exist, but whether users of these capabilities are evaluating and validating them against real project artifacts.
The regulatory frameworks for AI in healthcare are demanding but exist for good reason. Patient safety always depends on technologies that are not just accurate in a lab, but validated, transparent, and accountable in the real world. That standard is worth meeting well.
Arrow Electronics offers a knowledge hub on technological advancements in medical diagnostics. This resource aims to support professionals and organisations navigating the fast-paced landscape of healthcare technology. The website can be accessed here, the medical webinar from Arrow will be available here and a whitepaper on AI-powered medical diagnostic and therapy devices is available here.
This article originally appeared in the May/June issue of Procurement Pro
